OWASP CRS

The OWASP Core Rule Set, or CRS, is a set of generic attack detection rules meant to be loaded into a web application firewall. It works with OWASP ModSecurity, OWASP Coraza and other compatible engines rather than running as a standalone application. The rules are written to protect web applications against a broad range of attacks while keeping false alerts to a minimum.

Coverage is aimed at threats such as those in the OWASP Top Ten. The project invites reports of false positives, false negatives and evasions through GitHub issues, and asks for the installed version and relevant audit log portions to help reproduce each case. Discussion takes place in a Google Group and the coreruleset channel on OWASP Slack, and the project website links to installation and configuration resources.

The ruleset is released under the Apache-2.0 license, with copyright held by Trustwave and contributors up to 2020 and by the CRS project afterward. The latest release listed is v4.29.0. Because it is a ruleset, it suits teams already operating a compatible WAF who want maintained, community-reviewed detection logic.